Fix Rust backend: secrets to keychain, status recovery, shutdown, dedup

- Move git_token and Bedrock credentials to OS keychain instead of
  storing in plaintext projects.json via skip_serializing + keyring
- Fix project status stuck in Starting on container creation failure
  by resetting to Stopped on any error path
- Add granular store methods to reduce TOCTOU race window
- Add auth_mode, project path, and bedrock config change detection
  to container_needs_recreation with label-based fingerprinting
- Fix mutex held across async Docker API call in exec resize by
  cloning exec_id under lock then releasing before API call
- Add graceful shutdown via on_window_event to clean up exec sessions
- Extract compute_env_fingerprint and merge_claude_instructions helpers
  to eliminate code duplication in container.rs
- Remove unused thiserror dependency
- Return error instead of falling back to CWD when data dir unavailable

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/src-tauri/src/storage/projects_store.rs

@@ -10,9 +10,9 @@ pub struct ProjectsStore {
 }
 
 impl ProjectsStore {
-    pub fn new() -> Self {
+    pub fn new() -> Result<Self, String> {
         let data_dir = dirs::data_dir()
-            .unwrap_or_else(|| PathBuf::from("."))
+            .ok_or_else(|| "Could not determine data directory. Set XDG_DATA_HOME on Linux.".to_string())?
             .join("triple-c");
 
         fs::create_dir_all(&data_dir).ok();
@@ -42,10 +42,10 @@ impl ProjectsStore {
             Vec::new()
         };
 
-        Self {
+        Ok(Self {
             projects: Mutex::new(projects),
             file_path,
-        }
+        })
     }
 
     fn lock(&self) -> std::sync::MutexGuard<'_, Vec<Project>> {